OBSERVABILITY
AIN OBS
عَين
We see what goes unseen — before it becomes an outage.
Four layers in one system: network, infrastructure, application performance, and flows and logs. It runs inside a closed environment with no internet at all, catches anomalies before they escalate into outages, and answers the operator through an AI assistant whose inference never leaves the organisation’s network.
The product in figures
- 20,000+
- Devices monitored
- 4
- Monitored layers
- 14+
- Service types
- 10+
- Microservices
- 13
- Saudi regions
What it solves
Fragmented monitoring. One system for the network, another for servers, a third for applications, a fourth for logs. When something breaks, the operations team walks between four screens to answer one question: what failed first?
A cloud probe cannot see an isolated network. Sensitive government environments are cut off from the internet by security decision, while global monitoring products assume a permanent connection to their cloud. The most sensitive environments end up the least monitored.
Alerts without context. Dozens of duplicate alerts for one symptom, with no link between a service and the device it runs on, and no identification of the original point of failure.
What the monitoring system does not know exists. Every network carries devices that were never registered, addresses sending logs nobody can place, and an application that stopped reporting without anyone noticing — because its absence is silent by nature.
AI that requires sending your data out. Intelligent operations assistants ship your logs and metrics to a model running in a foreign cloud — which data classification in sovereign entities forbids.
What the product does
Operations centre
A device matrix that reveals an outage at a glance, a live alert feed, and a live throughput chart. Dashboards are never rebuilt when they update — a value changes in place with a colour flash, without a single flicker.
Network management and discovery
A five-step add wizard that reads the device’s own identity and fills the form for you, a network scan over ICMP, SNMP v2c and v3, SSH and WinRM that shows results while it runs rather than after it, and an Excel import with suggested column mapping and a bulk connection test before anything is created.
Live topology
Discovery over LLDP, CDP and ARP, links drawn at a thickness that reflects confidence with a mark for those confirmed from both ends, and ghost nodes for devices present on the network but unmonitored — each promoted to a real device with one click.
Live compliance
A live SSH scan comparing a device’s running configuration against ready security baselines for Cisco IOS, NX-OS and ASA — with no prior backup — returning a percentage score and findings graded from critical to informational, or by scanning a configuration file pasted on the spot.
Flow analysis
NetFlow and IPFIX: top talkers, applications, ports and conversations, a filterable raw flow table, and a live feed with the newest first.
Alert management
A rule that knows its metric — the threshold field and its operators change with it, so an impossible rule cannot be built — scoped from a single device to an entire region, with hysteresis and deduplication, and acknowledge and resolve actions that each carry a note.
Device logs
A live tail of Syslog and SNMP traps pushed in under a second, a pause that freezes the scroll so the operator can read a line that was about to escape, and a screen that surfaces addresses sending logs while registered nowhere as devices.
Infrastructure monitoring
Windows, Linux, databases, Docker, Kubernetes, VMware, Hyper-V, IIS and Active Directory — their pages generated from a single template, with a tree descending from vCenter to host to virtual machine.
Request tracing
A single request’s journey across every service: a service topology, a waterfall showing exactly where the time went, and the database queries formatted inside each span — and the agent instruments an application without touching its code.
The service that went quiet
Registered services and their state: reporting, gone silent, or never seen — because a service that stopped sending is the most dangerous state of all, since its absence raises nothing by itself.
Dependency mapping
A map joining all three layers with named relationships, an impact tree showing what falls if this element falls, and a diagnosis that walks the tree to the root cause and then proves it with a live probe against the device itself.
Proactive monitoring
Anomalies, resource-exhaustion forecasts, slow upward trends, gradual drift and recurring issues — measured against the behaviour of the same hour on the same day rather than a flat average.
On-premises AI assistant
The operator asks in natural Arabic and the answer streams back word by word, with plain thinking steps rather than queries, session memory that reads the next question in context, and an index that learns from the questions that worked — all inference on an internal server.
Reporting
Built-in reports with filters generated from each report’s own definition and a preview that redraws with every change, a builder that composes a new report with no query written, and export to PDF, Excel and CSV carrying the organisation’s identity rather than the product’s.
Geographic site map
Thirteen administrative regions and their districts, from local map files that work with no internet, each area coloured by its own outage rate.
Operating model and security
- Operating model
- Air-gapped first — runs fully disconnected from the internet, with updates delivered on physical media
- Architecture
- Distributed microservices — ten services, with polling engines and infrastructure collectors rebalanced onto healthy nodes
- Database
- TimescaleDB hypertables for large-scale time-series workloads
- Local AI engine
- Ollama with qwen2.5 · multi-turn session memory · an internal learning index · zero external API dependency
- Protocols
- SNMP v2c and v3 · SSH · WinRM · ICMP · Syslog · SNMP traps · NetFlow and IPFIX · LLDP, CDP and ARP · HTTP and TCP
- Refresh
- Live patching with no rebuild · real-time WebSocket push · a refresh cadence of its own for each screen, pausing when the screen is hidden and resuming on return
- Licensing
- Modular — sections are enabled or hidden from the licence file with no redeploy
- Security
- JWT sessions · role-based access control that every access path passes through · multi-tenant isolation · encrypted transport · digitally signed update packages
- Language
- Native Arabic right-to-left interface · technical values stay in Latin · Hijri and Gregorian calendars · Saudi UTC+3
- Sovereignty
- What enters the platform, what leaves it and who reaches it — the organisation’s decision alone
- Sectors served
- Government · security-sensitive sectors · large enterprises with strict data-residency requirements
Frequently asked
- Does the product work with no internet connection at all?
- Yes. It is air-gapped first — it runs fully disconnected from the internet, with updates delivered on physical media. Even the geographic map works from local files, and the AI assistant runs on a language model installed inside the organisation.
- How does the AI assistant work without a cloud?
- All inference runs on an internal server via Ollama, with multi-turn session memory. The operator asks in natural Arabic and sees plain thinking steps — no queries and no technical jargon — and the questions that worked are kept in an internal learning index, so it improves with use. Your logs and metrics are never sent to any external party.
- Which systems does it monitor?
- Fourteen service types including Windows, Linux, VMware, Hyper-V, Kubernetes, Docker, Active Directory, PostgreSQL, MySQL, SQL Server, Oracle, IIS, Nginx and Apache — with agentless polling, alongside network devices over SNMP and SSH.
- Is a configuration backup needed before a compliance scan?
- No. The scan is entirely live: it connects to the device over SSH and compares its running configuration against ready security baselines for Cisco IOS, NX-OS and ASA, returning a percentage score and findings graded from critical to informational. A configuration file can also be pasted and scanned directly.
- How are applications connected to monitoring?
- A server is scanned and its applications appear sorted into those that can be instrumented automatically, those monitored agentlessly and those unsupported; an application is then instrumented with one click and without touching its code. From there, each request’s journey across services is shown as a waterfall that makes clear where the time went.
- Can a report be built that is not in the library?
- Yes. Alongside the built-in reports there is a builder where the user picks the dataset, columns, filters, grouping and sorting, previews the result and exports it — with no query written at all, and with performance guards enforced on the server.
- Does it support distributed sites?
- Yes, with distributed polling engines rebalanced onto healthy nodes, and a geographic view covering all thirteen administrative regions of the Kingdom down to district level, named in both Arabic and English — all from local map files.
See AIN OBS inside your own environment
One session on your infrastructure as it stands: we install it, show what your team would see on day one, and answer every question in front of your engineers.